Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2024-24558

18
FAUCET Score

CVE-2024-24558 is a cross-site scripting (XSS) vulnerability affecting the @tanstack/react-query-next-experimental NPM package, used for asynchronous state management and data fetching. With a CVSS score of 6.1 (Medium), exploitation requires an attacker to inject or have malicious input returned from an endpoint, impacting confidentiality and integrity. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage. Users should update to version 5.18.0 or later to remediate this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
>= 5.0.0, < 5.18.0CPE matchmatch criteria
cpe:2.3:a:tanstack:react-query-next-experimental:*:*:*:*:*:node.js:*:*

CVSS Data

CVSS version used by this source: 3.1

8.2HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
NONE
Exploitability Score
3.9
Impact Score
4.2
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.39%
Probability of exploitation in next 30 days
EPSS Percentile
31.1%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0039 is in the 32nd percentile among its peer group of 26,221 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (2)

github_advisorypatch availablevia nvd_reference
View patch
npmpatch availablevia ghsa
Product: @tanstack/react-query-next-experimentalFixed in: 5.18.0

Vendor Advisories (1)

npmGHSA-997g-27x8-43rfhigh

react-query-streamed-hydration Cross-site Scripting vulnerability

Jan 30, 2024

References

github.com / TanStack/query/commit/f2ddaf2536e8b71d2da88a9310ac9a48c13512a1
Patch
github.com / TanStack/query/security/advisories/GHSA-997g-27x8-43rf
Vendor Advisory